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Registers of Scotland is grateful for the opportunity to express its views in respect of the proposed review 
of the ICO’s Data Sharing Code of Practice. 


It is our view that the revised Code of Practice should fully address the issues in respect of the lawful basis 
for data sharing, particularly between public bodies, where an implied obligation, public interest, or official 
authority of the controller exists. The current code deals with implied obligations to share data, but these 
are likely to be viewed differently under the new data protection law, and so clarity will allow public sector 
bodies to confidently share data. This should include reference to the Digital Economy Act and its interplay 
with new data protection law. 


Given that the ICO has been clear with public bodies that it does not view the processing of personal data 
on the basis of their legitimate interest as prohibited (rather that it views the performance of a core public 
task and the use of legitimate interests as mutually exclusive), it would be helpful for the code to address 
the reasonably foreseeable need for public bodies to share personal data on the basis of their legitimate 
interests, where these are not overridden by the interests or rights and freedoms of data subjects (and 
notwithstanding the further obligations that result for controllers). 


It would be useful if the revised CoP can address the issue of compatibility of purpose and advise how this 
requirement can be appropriately met, in particular by public bodies, in a data sharing context. 
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